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(57) Abstract 

A fraud-proof keyboard ( 1 1 , 1 1 1, 21 1) for an automatic banking terminal ( 10) suitable for preventing the keys pressed on the keyboard 
by the person using the terminal during a banking operation from being detected and used to trace the personal identification code (PIN) 
or other confidential user data. The keyboard comprises means that automatically and randomly vary, between two successive banking 
operations, the number and/or symbol (25) associated with each key. More specifically the keyboard, according to a first embodiment (II), 
comprises a series of keys (24) each provided with a luminous matrix (31) suitable for displaying, in each banking operation, a different 
number and/or symbol or, according to a second embodiment (1 1 1), is built with a touch screen (1 12) arranged above a display unit (113), 
wherein the keys to be pressed are defined by areas (1 14) of the said display unit (1 13) and the numbers and/or symbols (25) represented 
thereon also change after each banking operation. 
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FRAUD-PROOF KEYBOA RD FOR AN AUTOMATIC BANKING TERMINAL 

FIELD OF THE INVENTION 
The present invention concerns a fraud-proof keyboard for an 
automatic banking terminal, suitable for preventing acts of fraud being 
5 perpetrated on the users of the terminal and comprising a plurality of keys, 
each of which represents a number and/or graphic symbol and may 
selectively be actuated in order to enter data in the terminal. In particular 
the keyboard is envisaged to prevent the actuations of its keys by the user 
being detected by outsiders in order to trace confidential user data, such 
10 as for instance the personal identification code (PIN) which, as is known, 
enables banking operations to be effected. 

BACKGROUND OF THE INVENTION 
A known system for fraudulently detecting the PIN of a user is that 
of laying a very thin sheet, practically imperceptible to the sight and touch 
15 of the user, but suitable for detecting the marks left by his fingers during 
the entry of data. Once the banking operation has been concluded by the 
user, the sheet is lifted off the keyboard and the marks impressed thereon 
used to trace the PIN. 

Another possible means of fraud is that of concealing a telecamera 
20 in the vicinity of the keyboard in order to film the movements of the user's 
fingers when entering personal data, and thus tracing the user data by 
subsequently analysing the movements filmed. 
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are easy to detect using the systems described above. 

SUMMARY OF THE INVENTION 
5 The object of this invention is the provision of a device that is 

extremely effective against fraud of all types and in particular the types 
described above, and which in addition is also easy to install, at low cost, 
including in banking terminals already in operation. 

This object is achieved by the fraud-proof keyboard according to the 
) present invention which, in accordance with a first embodiment, has the 
characteristics defined in claim 1. According to another aspect of the 
invention, the fraud-proof keyboard may have another embodiment, the 
characteristics of which are defined in claim 7. 

In particular, the first embodiment is suitable for being installed 
without distinction in terminals located in attended or unattended 
environments, being effective in avoiding fraud by way of telecameras and 
by way of the sheet laid over the keyboard. 

The further embodiment, on the other hand, is especially suitable for 
being installed in banking terminals located in attended environments, 
where it is possible to perform fraud only by way of the sheet laid over the 
keyboard, it being practically impossible to install telecameras in an 
attended area. 
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BRIEF DESCRIPTION OF THE DRAWINGS 
These and other characteristics, scopes and advantages of this 
invention will become apparent in the course of the following description of 
some of the preferred embodiments, provided as a non-exhaustive 
5 example, taken in conjunction with the accompanying drawings, where: 
Fig. 1 is a perspective view of an automatic banking terminal in which a 
fraud-proof keyboard according to the invention is installed; 
Fig. 2 is a plan view of a first embodiment of the keyboard according to 
the present invention; 
10 Fig. 3 is a partial section according to the line Ill-Ill of Fig. 2; 
Fig. 4 is a functional block diagram of the keyboard of Fig. 2; 
Fig. 5 is a diagram illustrating operation of the keyboard of Fig. 2; 
Fig. 6 is a partial sectional view of a second embodiment of the keyboard 
of Fig. 2; 

15 Fig. 7 is a functional block diagram of the keyboard of Fig. 6; 

Fig. 8 is a plan view of a further embodiment of the keyboard according to 
this invention; 

Fig. 9 is a partial sectional view of the keyboard of Fig. 8; and 
Fig. 10 is a diagram illustrating operation of the keyboard of Fig. 8. 
20 DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 

With reference to Fig. 1, an automatic banking terminal 10, more 
generally known as an ATM - the abbreviation of Automatic Teller 
Machine, incorporates a fraud-proof keyboard 1 1 according to the present 
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invention. The keyboard 11 is mounted on a fixed structure 12 of the 
terminal 10 and is associated with a series nneratinn unite 
named, such as for example a display 13, a reader 14 of personal cards, a 
device 16 for issuing receipts and a cash dispenser unit 15, enabling a user 
5 to perform a banking operation through the said terminal 10. 

In particular, before any generic banking operation, the user is 
enabled to effect the operation by introducing a personal card in the reader 
14 and typing his PIN on the keyboard 11. If the data read by the reader 
14 on the personal card and the PIN data typed are correct in the sense 
10 that both match with data stored within the terminal 10, then the user is 
enabled to effect the operation desired. 

With reference to Figs. 2-4, the keyboard 1 1 comprises a support 
case 21, a front 23 arranged on a side of the keyboard 1 1 facing the user, 
a plurality of keys 24 actuated by a user for entering data in the terminal 
15 10, an electronic circuit 26 arranged under the keys 24, and an output line 
27. On each actuation by the user, each key 24 generates a corresponding 
actuation signal S1, designed to be received by the electronic circuit 26. 
The latter in turn processes the actuation signals S1 of the keys 24 before 
generating corresponding output signals S2 indicative of the data entered 
20 by the user. A line 27 is provided for transmitting the signals S2 to the 
outside of the keyboard 1 1 towards computing units of the terminal 10. 

Both the case 21 and the front 23 possess a particularly robust 
structure to protect the exterior and interior of the keyboard 1 1 against 
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acts of vandalism and against all forms of tampering, designed for instance 
to detect the signals circulating within the keyboard 11 in order to 
fraudulently pick up the data entered by the user. 

The electronic circuit 26 is divided into a main circuit 28, which 
5 directly receives the actuation signals S1 generated by the keys 24, and a 
security circuit 29 associated with the main circuit 28 and suitable for 
rendering secure the transfer of data from the keyboard 11 to the 
computing units of the banking terminal 10. For this purpose, the security 
circuit 29 is suitable for arranging the output signals S2 in a special secret 

10 form, also called encrypted, designed to prevent the signals from being de- 
ciphered and the data being obtained fraudulently. 

The keys 24 are associated with a plurality of numbers and/or 
graphic symbols 25, each of which is represented on a corresponding key 
24 to indicate the data that it is possible to input and enter in the terminal 

15 10, by actuating the key in question. 

According to one characteristic of the invention, the keyboard 1 1 is 
provided with means suitable for randomly varying, between two 
successive banking operations, the numbers and/or symbols 25 
represented on the keys 24, so that the marks left by the fingers of a user 

20 on a sheet laid above the keyboard 11 for fraudulent designs, do not 
permit unfailing determination of the numbers and/or symbols that were 
typed by the user. 
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More specifically each key 24 comprises a luminous matrix 31 of 
known characteristics, also known as a "digit", which consists of a 
plurality of elements that are selectively lit to represent the numbers and/or 
graphic symbols 25. The matrices 31 are mounted on a support board 33 
connected with the main circuit 28 and bearing appropriate circuits for 
electrical power supply of the matrices 31 . 

The matrices 31 are apt to be driven by the main circuit 28 for 
varying, between two successive banking operations, brightness of the 
respective illuminating elements, so that the numbers and/or graphic 
symbols 25 represented on the matrices 31 change according to a random 
law, but in such a way that, on each variation, all the numbers and/or 
symbols 25 needed for data entry still appear in their entirety on the 
various keys 24. It will therefore be clear that the keyboard 1 1 is suitable 
for presenting, during a generic banking operation, a different and 
unpredictable arrangement of the numbers and/or symbols 25 on the keys 
24 with respect to the arrangement presented during the preceding 
banking operation. 

In ways that are widely known and used in the sector art, the 
random variation of the numbers and/or symbols 25 represented on the 
keys 24 may be obtained by means of a specific circuit, integrated in the 
electronic circuit 26 and of a type capable of generating random numbers. 

Each key 24 further comprises a piezoelectric element 32 arranged 
above the luminous matrix 31 and suitable for generating, through the 
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effect of pressure applied by the user, the signal S1 indicating actuation of 
the key in question. The different piezoelectric elements 32 are supported 
by a sheet 35, and each possesses a crown shape around a hole in the 
sheet 35 with the purpose of permitting observation by the user of the 
5 number or symbol displayed by the matrix 31 . 

A flexible plate 36, arranged on top of the sheet 35 on the external 
face of the keyboard 11, is provided with transparent areas in 
correspondence with the luminous matrices 31 to permit observation of the 
relative numbers and/or symbols 25 and is sufficiently thin so as to bend 
10 and transmit the pressure of the user to the different piezoelectric elements 
32 underneath in order to activate them. 

A cable 37 connects the sheet 35 with the electronic circuit 26 for 
transmission to the latter of the actuation signals S1 . 

The electronic circuit 26 is also provided with circuits associating the 
15 actuation signals S1 generated by the piezoelectric elements 32 with the 
numbers and/or graphic symbols 25 represented on the keys 24 at the time 
they are actuated, in order to enter in the terminal 10 the data effectively 
input by the user. 

Operation of the keyboard 1 1 described thus far is as follows. At the 
20 start of each new banking operation, the user inserts his personal card in 
the reader 14. When the terminal 10 verifies presence of the card, the 
electronic circuit 26 drives (phase 41 in Fig. 5) the luminous matrices 31 
so as to vary according to a random law the numbers and/or symbols 25 
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represented thereon, so that the latter adopt a completely unpredictable 
disposition from the one they had during the previous bankino oneration 

w -i . . . 

At this point, the user types his data (phase 42) by pressing the various 
keys 24, and the piezoelectric elements 32 relative to each of the keys 

5 pressed generate corresponding actuation signals S1 which are received by 
the electronic circuit 26. The latter associates (phase 43) the actuation 
signals received with the effective disposition of the numbers and/or 
symbols 25 on the keys 24 at that time, in order to ascertain the data 
effectively input by the user. These data are then transferred to outside the 

) keyboard in encrypted form by means of the output signals S2 transiting 
on the line 27. 

A second embodiment of the fraud-proof keyboard, indicated with 
the numeral 1 1 1 and illustrated in Figs. 6 and 7, comprises a support case 
1 15, a substantially transparent, tactile type screen 1 12, a display unit 113 
arranged under the screen 1 12, and a main electronic circuit 126. 

The screen 1 12, of known characteristics and of the type commonly 
called touch screen, is provided with tactile properties so that, when 
touched at any point of the surface, it generates a corresponding contact 
signal S3. Further, the screen 112 is provided with a grid suitable for 
conveying the contact signal S3 thus generated to a suitable recognition 
circuit, integrated in the circuit 126, suitable for recognizing exactly which 
zone of the surface of the screen 1 12 has been touched. 



BNSDOCIO <WO 9827S1BA1 I > 



WO 98/27518 



PCT/IT97/0G308 



The display unit 113 is, for example, of the liquid crystal type (LCD) 
and is suitable for displaying the numbers and/or graphic symbols 25, 
indicative of the data input using the keyboard 111, inside areas 114 
arranged in a pre-established way on the surface of the said display unit 
5 113. 

These areas 114 with the relative numbers and/or symbols are 
clearly visible to the user, as the screen 1 1 2 is transparent: 

The electronic circuit 126 is suitable for driving the display unit 113 
so that the numbers and/or symbols 25 displayed in the areas 114 vary 
10 randomly between two successive banking operations, in the same way as 
already seen for the keyboard 1 1 . 

In using the keyboard 111, the users inputs his data by touching the 
screen 112 exactly on the areas 114 with the numbers and/or symbols 
indicating the data, and accordingly activates a series of contact signals 
15 S3. The latter are received by the circuit 126 where they are associated 
with the above-mentioned areas 114 and with the numbers and/or symbols 
25 represented thereon at that time, so that the data effectively input by 
the user may be ascertained and entered in the terminal 10. 

Figs. 8 and 9 represent a further embodiment of the fraud-proof 
20 keyboard, indicated generically by numeral 211. It consists of a 
conventional type keyboard body 212, provided with keys 224, and a 
device 213 suitable for detecting the presence of foreign elements on the 
outer surface of the keys 224. 

sw^nnrin <wo m»7sibai i > 
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In further detail, the device 213, also called wave conveyor, 
comprises a transmitter 214 emittina sound waves 215 «f r>roHo«„-w 
characteristics and a receiver 216 suitable for receiving these waves and 
measuring the characteristics thereof. The transmitter 214 and the receiver 
5 216 are arranged one in front of the other on opposite sides of the 
keyboard 211 so that the waves emitted by the transmitter 214 are 
conveyed along the surface of the keys 224 to the receiver 216. 
Operation of the keyboard 213 is as follows. 

At the beginning of each banking operation, the device 213 during 
10 phase 231 (Fig. 10) verifies if the characteristics of the waves 215 
received by the receiver 216 are conforming to the predefined 
characteristics of the waves emitted by the transmitter 214. If they are 
conforming, the keyboard 21 1 prepares to receive the user data so that the 
banking operation may be duly effected. During the time required for the 
15 operation, the device 213 is disabled in order to avoid the device 213 
unduly signalling a change in status of the surface of the keys 224 on 
account of the keys pressed by the user. 

If they are not conforming, the keyboard 211 informs the user 
(phase 232), for example by posting a suitable message on the display 13, 
20 that surface conditions of the keys 224 have been altered from their 
normal conditions and that action must be taken to remove the reason for 
this alteration. At the same time, the keyboard 211 is disabled, so that the 
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user can no longer continue effecting the banking operation. This bar 
remains until such time as the cause of the alteration is removed. 

It is obvious that various changes and/or improvements may be 
made to the fraud-proof keyboard corresponding to the preferred 
embodiments described in the foregoing, without exiting from the scope of 
the present invention. 
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CLAIMS 

1 - A fraud-proof keyboard (11; 111) for an automatic banking terminal 
(10), comprising 

a plurality of keys (24), each of which represents a number and/or 
5 graphic symbol (25) and is provided for being selectively actuated in order 
to enter data in the terminal (10), 

characterised by electronic variation means (26, 31; 126, 113) for 
varying the number and/or symbol (25) represented on each of said keys 
(24). 

io 2 - A keyboard (11; 111) according to the claim 1, wherein each of said 
keys (24) is suitable for generating a corresponding electric actuation 
signal (S1; S3), and wherein an electronic circuit (26; 126) is provided for 
receiving said electric actuation signal (SI; S3), characterized in that said 
electronic circuit (26; 126) is suitable, when a generic key (24) is actuated, 
is for associating the corresponding actuation signal (S1; S3) with the 
number and/or graphic symbol (25) represented on said generic key (24), 
whereby the datum corresponding to the number and/or graphic symbol 
represented on said generic key (24) is entered in said terminal (10). 
3 - A keyboard (1 1; 1 11) according to either claim 1 or 2, characterized in 
d that said electronic variation means comprise a luminous matrix (31) for 
each of said keys (24) and in that each luminous matrix (31) is suitable for 
lighting variably between two successive banking operations, in order to 
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display a different number and/or graphic symbol (25) on the 
corresponding key (24). 

4 - A keyboard according to the claim 3, characterized by the fact that 
each of said keys (24) comprises a piezoelectric element (32) for 

5 generating said actuation signal (S1), by the fact that the piezoelectric 
elements (32) of the various keys (24) are arranged on a sheet (35) laid on 
top of said luminous matrices (31), and by the fact that each of said 
piezoelectric elements (32) is associated with a transparent area of said 
sheet (35) to permit observation of the number and/or symbol represented 
10 on the respective key. 

5 - A keyboard according to the claim 2, characterized by the fact that said 
electronic variation means comprise a display unit (113) having a plurality 
of areas (114) each of which defining a corresponding key, by the fact that 
a touch screen (1 12) is laid on top of said display unit (113) for generating 

15 the electric actuation signals (S3) of said keys, and by the fact that each of 
said areas (114) is suitable for representing a different number and/or 
graphic symbol (25) between two successive banking operations. 

6 - A keyboard (11; 111) according to either claim 1 or 2, characterized by 
the fact that said electronic variation means comprise random number 

20 generating means, so that the numbers and/or symbols represented on said 
keys vary randomly between two successive banking operations. 

7 - A fraud-proof keyboard (211) for an automatic banking terminal (10), 
comprising a plurality of keys (224), each of which represents a number 
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and/or graphic symbol (25) and may selectively be actuated in order to 
enter data in the terminal, 

characterized by having a wave conveyor type device (213) for 
signalling an alteration of the surface state of said keys (224) between two 
5 successive banking operations. 
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